ANALYZE THE RECEIVED DATA 
PACKETS FOR THE EXISTENCE OF 
PRESELECTED IDENTIFICATION 
INFORMATION CORRESPONDING 
TO AN ATTACK 
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EXTRACT THE IDENTIFICATION 
INFORMATION ASSOCIATED WITH 
ATTACK SOURCE 
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LOG ACTIVITY AND 
IDENTIFICATION INFORMATION 
ASSOCIATED WITH THE 
CAPTURED DATA PACKETS 



EVALUATE THE LOG TO 
DETERMINE THE SEVERITY OF 
THE ATTACK 



CATEGORIZE THE SEVERITY OF 
THE ATTACK BASED ON 
PREDEFINED INDICATORS 



DISABLE THE SOURCE OF THE 
ATTACK 
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OBTAIN AN INDICATION 
OF AN ATTACK ON THE 
TARGET SYSTEM 



ISSUE AN ALERT OF 
A SUSPECTED AND/OR 
CONFIRMED ATTACK ON 
THE TARGET SYSTEM 
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OUTSIDE 



DETERMINE 
^WHETHER THE ATTACK ON THE N 
TARGET SYSTEM ORIGINATED 
FROM INSIDE OR OUTSIDE 
THE TARGET SYSTEM 



INSIDE 
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335, 



INSTRUCT THE 
FIREWALL TO 
BLOCK THE DATA 
ASSOCIATED WITH THE 
IDENTIFIED DATA PACKETS 



BOTH 



INSTRUCT THE 
SERVER TO BLOCK AND/OR 
CONTAIN THE DATA 
ASSOCIATED 
WITH THE IDENTIFIED 
DATA PACKETS 
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DETERMINE WHETHER THE 
SEVERITY OF THE ATTACK 
ATTAINED A PREDETERMINED 
THRESHOLD 



NO 



end 
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DETERMINE WHETHER THE 
SEVERITY OF THE ATTACK 
ATTAINED A PREDETERMINED 
THRESHOLD 



INSTRUCT THE 
ROUTER TO BLOCK 
THE DATA ASSOCIATED 
WITH THE IDENTIFIED 
SOURCE 
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INSTRUCT THE 
SERVER TO BLOCK AND/OR 
CONTAIN ANY DATA 

ASSOCIATED 
WITH THE IDENTIFIED 
SOURCE 
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